Re: choosing principal names

On Thu, Oct 6, 2011 at 5:55 PM, Russ Allbery <[email protected]> wrote:
> Nico Williams <[email protected]> writes:
>> On Thu, Oct 6, 2011 at 5:37 PM, Russ Allbery <[email protected]> wrote:
>
>>> I think LDAP lookups are superior to the PAC in every possible respect
>>> except for performance and the requirement to contact a central service
>>> (PAC data can work in a more decoupled network environment).
>
>> Except for Simo's use case, where the application server can't talk to
>> the client principal's LDAP server for policy reasons.
>
> That's what I mean in part by a decoupled network environment.
>
>> I suppose that if LDAP servers implemented suitable filtering policy
>> languages, then the privacy issues could be addressed without a PAC.
>
> And, of course, they do.  :)  OpenLDAP has very extensive support for
> partial disclosure of a record, or even providing entirely different data
> depending on who asks.  We use that pretty extensively at Stanford because
> we're very aggressive about data privacy controls.

Have you talked to Simo about this?